XXE Vulnerability in Apache Syncope Console: org.apache.syncope.client.idrepo:syncope-client-idrepo-console
Summary
GHSA-73f3-rqqf-2j54: Apache Syncope: Console XXE on Keymaster parameters. Affects org.apache.syncope.client.idrepo:syncope-client-idrepo-console across 2 version ranges.
>= 3.0.0, < 3.0.16
>= 4.0.0, < 4.0.4
Fixed in 3.0.16 or 4.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Syncope is an open-source system for managing identity and access rights. It provides a comprehensive solution for managing user identities, roles, and permissions across various applications. The affected package, syncope-client-idrepo-console, is a component of Apache Syncope that allows administrators to manage Keymaster parameters through a web console interface. This package is crucial for ensuring secure and efficient identity management, but it has been found to be vulnerable to an XML External Entity (XXE) attack.
Vulnerability Detail
The vulnerability arises from improper restriction of XML External Entity references in the Apache Syncope Console. An administrator with sufficient permissions can craft malicious XML input to exploit this vulnerability, potentially leading to sensitive data leakage. This issue affects versions 3.0 through 3.0.15 and 4.0 through 4.0.3 of the affected package. The risk associated with this vulnerability is classified as moderate, with a CVSS score of 4.9, indicating that while it is not the most severe, it can still lead to significant data exposure if exploited.
How To Fix
Latest published version: 4.1.3 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.0.163.0.16 -
>= 4.0.0, < 4.0.44.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators should avoid using the vulnerable features of the Apache Syncope Console until an upgrade can be performed. Additionally, ensure that XML input is properly validated and sanitized to mitigate the risk of XXE attacks.
Conclusion
The XXE vulnerability in Apache Syncope Console poses a risk of sensitive data leakage through malicious XML input. Users are strongly advised to upgrade to the patched versions of the affected package to mitigate this risk. Implementing proper input validation can also help reduce exposure until an upgrade can be performed.
See every vulnerability recorded for org.apache.syncope.client.idrepo:syncope-client-idrepo-console →
FAQ
An XXE (XML External Entity) attack is a type of security vulnerability that allows an attacker to interfere with the processing of XML data. It can lead to the disclosure of confidential data, server-side request forgery, and other security issues.
The vulnerability affects Apache Syncope versions 3.0 through 3.0.15 and 4.0 through 4.0.3.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without any signup.
If an immediate upgrade is not possible, implement input validation and sanitization for XML data to reduce the risk of exploitation. Additionally, limit access to the console for users who do not need it.
The CVSS score of this vulnerability is 4.9, indicating a moderate severity level.
